CVEs published April 5, 2023
139 CVEs were published on April 5, 2023: 7 critical, 28 high. 1 is now in CISA KEV.
- Published
- 139
- Critical
- 7
- High
- 28
- Medium
- 92
- Low
- 10
- Unrated
- 2
- Now in CISA KEV
- 1
- Fix available
- 46
Most affected products
- Cisco Small Business RV Series Router Firmware
- 20
- GitLab
- 14
- thorsten/phpmyfaq
- 12
- SourceCodester Online Payroll System
- 9
- Cisco Identity Services Engine Software
- 8
- glpi-project glpi
- 7
- pluginbuilders YourChannel: Everything you want in a YouTub…
- 7
- Cisco Prime Infrastructure
- 5
- Ichitaro
- 4
- Bhima
- 3
Critical 7
- CVE-2023-1782Nomad Unauthenticated Client Agent HTTP Request Privilege EscalationHashiCorp Nomad · github.com/hashicorp/nomad
- CVE-2022-4939WCFM Membership <= 2.10.0 - Unauthenticated Privilege Escalationwclovers WCFM Membership – WooCommerce Memberships for Mult…
- CVE-2023-28849GLPI vulnerable to SQL injection and Stored XSS via inventory agent requestglpi-project glpi
- CVE-2023-28838GLPI vulnerable to SQL injection through dynamic reportsglpi-project glpi
- CVE-2022-31890SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via
- CVE-2023-24720An arbitrary file upload vulnerability in readium-js v0.32.0 allows attackers to execute arbitrary code via uploading a crafted EPUB file.
- CVE-2023-29374In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec metlangchain
High 28
- CVE-2023-1522SQL Injection in the Hardware Inventory report of Security Center 5.11.2.Genetec Security Center
- CVE-2022-4940WCFM Membership <= 2.10.0 - Missing Authorizationwclovers WCFM Membership – WooCommerce Memberships for Mult…
- CVE-2023-29006Order GLPI plugin vulnerable to remote code execution from authenticated userpluginsGLPI order
- CVE-2022-4935WCFM Marketplace <= 3.4.11 - Missing Authorizationwclovers WCFM Marketplace – Multivendor Marketplace for Woo…
- CVE-2023-28634GLPI vulnerable to Privilege Escalation from Technician to Super-Adminglpi-project glpi
- CVE-2023-1412Local Privilege Escalation Vulnerability in WARP's MSI InstallerCloudflare WARP
- CVE-2022-43664A use-after-free vulnerability exists within the way Ichitaro Word Processor 2022, version 1.0.1.57600, processes protected documents.Ichitaro
- CVE-2022-45115A buffer overflow vulnerability exists in the Attribute Arena functionality of Ichitaro 2022 1.0.1.57600.Ichitaro
- CVE-2023-22291An invalid free vulnerability exists in the Frame stream parser functionality of Ichitaro 2022 1.0.1.57600.Ichitaro
- CVE-2023-22660A heap-based buffer overflow vulnerability exists in the way Ichitaro version 2022 1.0.1.57600 processes certain LayoutBox stream record typIchitaro
- CVE-2023-28632GLPI vulnerable to account takeover by authenticated userglpi-project glpi
- CVE-2022-31888Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2.
- CVE-2023-0670Ulearn version a5a7ca20de859051ea0470542844980a66dfc05d allows an attacker with administrator permissions to obtain remote code execution onUlearn
- CVE-2023-1757Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-1758Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-1878Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-1880Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-1881Cross-site Scripting (XSS) - Stored in microweber/microwebermicroweber/microweber
- CVE-2023-1882Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-1886Authentication Bypass by Capture-replay in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-1887Business Logic Errors in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-1892Cross-site Scripting (XSS) - Reflected in sidekiq/sidekiqsidekiq/sidekiq · sidekiq
- CVE-2023-20102Cisco Secure Network Analytics Remote Code Execution VulnerabilityCisco Secure Network Analytics
- CVE-2023-20117Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2023-20128Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2023-26856Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/ajax.php?ac
- CVE-2023-26857An arbitrary file upload vulnerability in /admin/ajax.php?action=save_uploads of Dynamic Transaction Queuing System v1.0 allows attackers to
- CVE-2023-28342Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.
Medium, low and unrated 104
- CVE-2022-4941WCFM Membership <= 2.9.10 - Cross-Site Request Forgerywclovers WCFM Membership – WooCommerce Memberships for Mult…
- CVE-2023-28855Fields GLPI plugin vulnerable to unauthorized write access to additional fieldspluginsGLPI fields
- CVE-2023-28852GLPI vulnerable to stored Cross-site Scripting through dashboard administrationglpi-project glpi
- CVE-2022-4938WCFM Frontend Manager <= 6.5.13 - Cross-Site Request Forgerywclovers WCFM – Frontend Manager for WooCommerce
- CVE-2022-4937The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and includinwclovers WCFM – Frontend Manager for WooCommerce along with…
- CVE-2022-4936WCFM Marketplace <= 3.4.12 - Cross-Site Request Forgerywclovers WCFM Marketplace – Multivendor Marketplace for Woo…
- CVE-2023-28636GLPI vulnerable to stored Cross-site Scripting in external linksglpi-project glpi
- CVE-2023-20118A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers Cisco Small Business RV Series Router Firmware
- CVE-2023-28633GLPI vulnerable to Blind Server-Side Request Forgery (SSRF) in RSS feedsglpi-project glpi
- CVE-2023-1871YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation Resetpluginbuilders YourChannel: Everything you want in a YouTub…
- CVE-2023-1870YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation Updatepluginbuilders YourChannel: Everything you want in a YouTub…
- CVE-2023-1869YourChannel <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scriptingpluginbuilders YourChannel: Everything you want in a YouTub…
- CVE-2023-1868YourChannel <= 1.2.3 - Missing Authorization to Plugin Cache Resetpluginbuilders YourChannel: Everything you want in a YouTub…
- CVE-2023-1867YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Settings Changepluginbuilders YourChannel: Everything you want in a YouTub…
- CVE-2023-1866YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Channel Resetpluginbuilders YourChannel: Everything you want in a YouTub…
- CVE-2023-1865YourChannel <= 1.2.3 - Missing Authorization to Plugin Settings Resetpluginbuilders YourChannel: Everything you want in a YouTub…
- CVE-2013-10022BestWebSoft Contact Form Plugin contact_form.php cntctfrm_check_form cross site scriptingBestWebSoft Contact Form Plugin
- CVE-2023-1860Keysight IXIA Hawkeye licenses cross site scriptingKeysight IXIA Hawkeye
- CVE-2023-1858SourceCodester Earnings and Expense Tracker App index.php information disclosureSourceCodester Earnings and Expense Tracker App
- CVE-2023-28069 Dell Streaming Data Platform prior to 1.4 contains Open Redirect vulnerability.Dell Streaming Data Platform
- CVE-2023-1857SourceCodester Online Computer and Laptop Store cross site scriptingSourceCodester Online Computer and Laptop Store
- CVE-2023-1856SourceCodester Air Cargo Management System GET Parameter track_shipment.php sql injectionSourceCodester Air Cargo Management System
- CVE-2023-1854SourceCodester Online Graduate Tracer System session expirationSourceCodester Online Graduate Tracer System
- CVE-2023-1853SourceCodester Online Payroll System employee_edit.php cross site scriptingSourceCodester Online Payroll System
- CVE-2023-1852SourceCodester Online Payroll System deduction_edit.php cross site scriptingSourceCodester Online Payroll System
- CVE-2023-1851SourceCodester Online Payroll System employee_add.php cross site scriptingSourceCodester Online Payroll System
- CVE-2023-26536WordPress Sp*tify Play Button for WordPress Plugin <= 2.05 is vulnerable to Cross Site Scripting (XSS)Jonk @ Follow me Darling Sp*tify Play Button for WordPress
- CVE-2023-1850SourceCodester Online Payroll System login.php sql injectionSourceCodester Online Payroll System
- CVE-2023-1849SourceCodester Online Payroll System cashadvance_row.php sql injectionSourceCodester Online Payroll System
- CVE-2023-1848SourceCodester Online Payroll System attendance_row.php sql injectionSourceCodester Online Payroll System
- CVE-2023-1847SourceCodester Online Payroll System attendance.php sql injectionSourceCodester Online Payroll System
- CVE-2023-1846SourceCodester Online Payroll System deduction_row.php sql injectionSourceCodester Online Payroll System
- CVE-2023-0382Uncontrolled Resource Consumption in M-Files ServerM-Files Server
- CVE-2023-1845SourceCodester Online Payroll System employee_row.php sql injectionSourceCodester Online Payroll System
- CVE-2022-31889Cross Site Scripting (XSS) vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533
- CVE-2022-3375An issue has been discovered in GitLab affecting all versions starting from 11.10 before 15.8.5, all versions starting from 15.9 before 15.9GitLab
- CVE-2022-3513An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting from 15.9 before 15.9.GitLab
- CVE-2023-0319An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting from 15.9 before 15.9.GitLab
- CVE-2023-0450An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and from 15.10 to 15.10.GitLab
- CVE-2023-0523An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1GitLab
- CVE-2023-0838An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1.GitLab
- CVE-2023-0842xml2js 0.4.23 - Prototype Pollutionxml2js
- CVE-2023-0944Bhima version 1.27.0 allows an authenticated attacker with regular user permissions to update arbitrary user session data such as username, Bhima
- CVE-2023-0959Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link senBhima
- CVE-2023-0967Bhima version 1.27.0 allows an attacker authenticated with normal user permissions to view sensitive data of other application users and datBhima
- CVE-2023-1071An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all veGitLab
- CVE-2023-1098An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all verGitLab
- CVE-2023-1167Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all verGitLab
- CVE-2023-1417An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.1GitLab
- CVE-2023-1582A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel.Linux
- CVE-2023-1708An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 whGitLab
- CVE-2023-1710A sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior to 15.9.4 and 15.10 GitLab
- CVE-2023-1733A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9.GitLab
- CVE-2023-1756Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-1787An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.1GitLab
- CVE-2023-1788Insufficient Session Expiration in firefly-iii/firefly-iiifirefly-iii/firefly-iii · grumpydictator/firefly-iii
- CVE-2023-1838A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a Kernel
- CVE-2023-1855A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel Driver (xgene-hKernel
- CVE-2023-1877Command Injection in microweber/microwebermicroweber/microweber
- CVE-2023-1879Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-1883Improper Access Control in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-1884Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-1885Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-20021Cisco Identity Services Engine Privilege Escalation VulnerabilitiesCisco Identity Services Engine Software
- CVE-2023-20022Cisco Identity Services Engine Privilege Escalation VulnerabilitiesCisco Identity Services Engine Software
- CVE-2023-20023Cisco Identity Services Engine Privilege Escalation VulnerabilitiesCisco Identity Services Engine Software
- CVE-2023-20030Cisco Identity Services Engine XML External Entity Injection VulnerabilityCisco Identity Services Engine Software
- CVE-2023-20051Cisco Packet Data Network Gateway IPsec ICMP Denial of Service VulnerabilityCisco ASR 5000 Series Software
- CVE-2023-20068Cisco Prime Infrastructure Reflected Cross-Site Scripting VulnerabilityCisco Prime Infrastructure
- CVE-2023-20073Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Arbitrary File Upload VulnerabilityCisco Small Business RV Series Router Firmware
- CVE-2023-20096Cisco Unified Contact Center Express Stored Cross-Site Scripting VulnerabilityCisco Unified Contact Center Express
- CVE-2023-20103Cisco Secure Network Analytics Remote Code Execution VulnerabilityCisco Secure Network Analytics
- CVE-2023-20121Cisco Evolved Programmable Network Manager, Cisco Identity Services Engine, and Cisco Prime Infrastructure Command Injection VulnerabilitiesCisco Identity Services Engine Software
- CVE-2023-20122Cisco Evolved Programmable Network Manager, Cisco Identity Services Engine, and Cisco Prime Infrastructure Command Injection VulnerabilitiesCisco Identity Services Engine Software
- CVE-2023-20123Cisco Duo Authentication for macOS and Duo Authentication for Windows Logon Offline Credentials Replay VulnerabilityCisco Duo
- CVE-2023-20124Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers Remote Command Execution VulnerabilityCisco Small Business RV Series Router Firmware
- CVE-2023-20127Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager VulnerabilitiesCisco Prime Infrastructure
- CVE-2023-20129Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager VulnerabilitiesCisco Prime Infrastructure
- CVE-2023-20130Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager VulnerabilitiesCisco Prime Infrastructure
- CVE-2023-20131Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager VulnerabilitiesCisco Prime Infrastructure
- CVE-2023-20132Cisco Webex Meetings Web UI VulnerabilitiesCisco Webex Meetings
- CVE-2023-20134Cisco Webex Meetings Web UI VulnerabilitiesCisco Webex Meetings
- CVE-2023-20137Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2023-20138Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2023-20139Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2023-20140Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2023-20141Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2023-20142Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2023-20143Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2023-20144Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2023-20145Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2023-20146Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2023-20147Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2023-20148Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2023-20149Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2023-20150Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2023-20151Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2023-20152Cisco Identity Services Engine Command Injection VulnerabilitiesCisco Identity Services Engine Software
- CVE-2023-20153Cisco Identity Services Engine Command Injection VulnerabilitiesCisco Identity Services Engine Software
- CVE-2023-24747Jfinal CMS v5.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/dict/list.
- CVE-2023-25330A SQL injection vulnerability in Mybatis plus below 3.5.3.1 allows remote attackers to execute arbitrary SQL commands via the tenant ID valucom.baomidou:mybatis-plus
- CVE-2023-26789Veritas NetBackUp OpsCenter Version 9.1.0.1 is vulnerable to Reflected Cross-site scripting (XSS).
- CVE-2023-28639GLPI vulnerable to reflected Cross-site Scripting in search pagesglpi
- CVE-2023-29389Toyota RAV4 2021 vehicles automatically trust messages from other ECUs on a CAN bus, which allows physically proximate attackers to drive a